Changeset 448

Show
Ignore:
Timestamp:
07/16/05 13:25:38 (8 years ago)
Author:
ahu
Message:

documentation, ldap fixes for bug #17

Location:
trunk/pdns
Files:
2 modified

Legend:

Unmodified
Added
Removed

  • trunk/pdns/modules/ldapbackend/ldapbackend.cc

    r284 r448  
    126126        string dn; 
    127127        string filter; 
    128  
     128    string qesc; 
     129 
     130 
     131        dn = getArg( "basedn" ); 
     132        qesc = toLower( m_pldap->escape( target ) ); 
    129133 
    130134        // search for SOARecord of target 
    131         dn = getArg( "basedn" ); 
    132         filter = "(associatedDomain=" + target + ")"; 
     135        filter = strbind( ":target:", "(associatedDomain=" + qesc + ")", getArg( "filter-axfr" ) ); 
    133136        m_msgid = m_pldap->search( dn, LDAP_SCOPE_SUBTREE, filter, (const char**) ldap_attrany ); 
    134137        m_pldap->getSearchEntry( m_msgid, m_result, true ); 
    … …  
    141144 
    142145        prepare(); 
    143         filter = "(associatedDomain=*." + target + ")"; 
     146        filter = strbind( ":target:", "(associatedDomain=*." + qesc + ")", getArg( "filter-axfr" ) ); 
    144147        DLOG( L << Logger::Debug << m_myname << " Search = basedn: " << dn << ", filter: " << filter << endl ); 
    145148        m_msgid = m_pldap->search( dn, LDAP_SCOPE_SUBTREE, filter, (const char**) ldap_attrany ); 
    … …  
    212215                attributes = attronly; 
    213216        } 
     217 
     218        filter = strbind( ":target:", filter, getArg( "filter-lookup" ) ); 
    214219 
    215220        DLOG( L << Logger::Debug << m_myname << " Search = basedn: " << getArg( "basedn" ) << ", filter: " << filter << ", qtype: " << qtype.getName() << endl ); 
    … …  
    256261        } 
    257262 
     263        filter = strbind( ":target:", filter, getArg( "filter-lookup" ) ); 
     264 
    258265        DLOG( L << Logger::Debug << m_myname << " Search = basedn: " << getArg( "basedn" ) << ", filter: " << filter << ", qtype: " << qtype.getName() << endl ); 
    259266        m_msgid = m_pldap->search( getArg( "basedn" ), LDAP_SCOPE_SUBTREE, filter, (const char**) attributes ); 
    … …  
    271278 
    272279 
    273         qesc = toLower( qname ); 
     280        qesc = toLower( m_pldap->escape( qname ) ); 
    274281        filter = "(associatedDomain=" + qesc + ")"; 
    275282 
    … …  
    281288                attributes = attronly; 
    282289        } 
     290 
     291        filter = strbind( ":target:", filter, getArg( "filter-lookup" ) ); 
    283292 
    284293        stringtok( parts, qesc, "." ); 
    … …  
    489498                declare( suffix, "secret", "User password for non anonymous binds", "" ); 
    490499                declare( suffix, "method", "How to search entries (simple, strict or tree)", "simple" ); 
     500                declare( suffix, "filter-axfr", "LDAP filter for limiting AXFR results", ":target:" ); 
     501                declare( suffix, "filter-lookup", "LDAP filter for limiting IP or name lookups", ":target:" ); 
    491502                declare( suffix, "disable-ptrrecord", "Depricated, use ldap-method=strict instead", "no" ); 
    492503        } 

  • trunk/pdns/pdns/docs/pdns.sgml

    r445 r448  
    8484      <sect2 id="changelog-2-9-18"><title>Version 2.9.18</title> 
    8585        <para> 
    86           Released on the 14th of July 2005. 
     86          Released on the 16th of July 2005. 
    8787        </para> 
    8888        <para>  
    … …  
    9292        </para> 
    9393        <para> 
    94           This release brings a number of new features, 
    95           but also has a new build dependency, the <ulink url="http://www.boost.org">Boost library</ulink>. 
     94          This release brings a number of new features (vastly improved recursor, Generic Oracle Support, DNS analysis and replay tools, and more)  
     95          but also has a new build dependency, the <ulink url="http://www.boost.org">Boost library</ulink> (version 1.31 or higher). 
    9696        </para> 
    9797        <para> 
    … …  
    108108        </para> 
    109109        <para> 
     110          Additionally, the bind2backend is almost ready to replace the stock bind backend. If you run with Bind zones, you are cordially invited 
     111          to substitute 'launch=bind2' for 'launch=bind'. This will happen automatically in 2.9.19! 
     112        </para> 
     113        <para> 
    110114          In other news, the entire Wikipedia constellation now runs on PowerDNS using the Geo Backend! Thanks to Mark Bergsma 
    111115          for keeping us updated. 
    112116        </para> 
    113117        <para> 
    114           General bugs fixed: 
     118          There are two bugs with security implications, which only apply to installations running with the LDAP backend, or installations providing recursion 
     119          to a limited range of IP addresses. If any of these apply to you, an upgrade is highly advised: 
    115120          <itemizedlist> 
    116121            <listitem> 
    117122              <para> 
    118                 TCP authoritative server would not relaunch a backend after failure (reported by Norbert Sendetzky) 
    119               </para> 
    120             </listitem> 
    121             <listitem> 
    122               <para> 
    123                 Fix backend restarting logic (reported, and fix suggested by Norbert Sendetzky) 
    124               </para> 
    125             </listitem> 
    126             <listitem> 
    127               <para> 
    128                 Launching identical backends multiple times, with different settings, did not work. Reported by Mario Manno. 
     123                The LDAP backend did not properly escape all queries, allowing it to fail and not answer questions. We have not investigated further risks involved, 
     124                but we advise LDAP users to update as quickly as possible (Norbert Sendetzky, Jan de Groot) 
    129125              </para> 
    130126            </listitem> 
    … …  
    136132              </para> 
    137133            </listitem> 
     134          </itemizedlist> 
     135        </para> 
     136        <para> 
     137          General bugs fixed: 
     138          <itemizedlist> 
     139            <listitem> 
     140              <para> 
     141                TCP authoritative server would not relaunch a backend after failure (reported by Norbert Sendetzky) 
     142              </para> 
     143            </listitem> 
     144            <listitem> 
     145              <para> 
     146                Fix backend restarting logic (reported, and fix suggested by Norbert Sendetzky) 
     147              </para> 
     148            </listitem> 
     149            <listitem> 
     150              <para> 
     151                Launching identical backends multiple times, with different settings, did not work. Reported by Mario Manno. 
     152              </para> 
     153            </listitem> 
     154 
    138155            <listitem> 
    139156              <para> 
    … …  
    338355              </para> 
    339356            </listitem> 
    340  
    341357            <listitem> 
    342358              <para> 
    … …  
    40774093    <sect1 id="security-policy"><title>Security</title> 
    40784094      <para> 
    4079         As of the 5th of February 2005, no actual security problems with PowerDNS 2.9.17 or later are known about. This page  
     4095        As of the 16th of July 2005, no actual security problems with PowerDNS 2.9.18 or later are known about. This page  
    40804096        will be updated with all bugs which are deemed to be security problems, or could conceivably lead to those. Any such notifications 
    4081         will also be sent to all PowerDNS mailinglists and BUGTRAQ. 
     4097        will also be sent to all PowerDNS mailinglists. 
     4098      </para> 
     4099      <para> 
     4100        All versions of PowerDNS before 2.9.18 contain the following two bugs, which only apply to installations running with the LDAP backend, or installations providing recursion 
     4101        to a limited range of IP addresses. If any of these apply to you, an upgrade is highly advised: 
     4102        <itemizedlist> 
     4103          <listitem> 
     4104            <para> 
     4105              The LDAP backend did not properly escape all queries, allowing it to fail and not answer questions. We have not investigated further risks involved, 
     4106              but we advise LDAP users to update as quickly as possible (Norbert Sendetzky, Jan de Groot) 
     4107            </para> 
     4108          </listitem> 
     4109          <listitem> 
     4110            <para> 
     4111              Questions from clients denied recursion could blank out answers to clients who are allowed recursion services, temporarily. Reported by Wilco Baan. 
     4112              This would've made it possible for outsiders to blank out a domain temporarily to your users. Luckily PowerDNS would send out SERVFAIL or Refused, and 
     4113              not a denial of a domain's existence. 
     4114            </para> 
     4115          </listitem> 
     4116        </itemizedlist> 
    40824117      </para> 
    40834118      <para> 
    … …  
    53765411            POSIX get/set/swapcontext functions. Bug your favorite FreeBSD kernel or libc maintainer for a fix, 
    53775412            or ask him to port MTasker (see below) to your operating system. It may work on recent 4.x systems,  
    5378             letus know! 
     5413            let us know! 
    53795414          </para></listitem> 
    53805415        <listitem><para> 
    … …  
    68286863  </chapter> 
    68296864  <chapter id="analysis"><title>Tools to analyse DNS traffic</title> 
    6830   <para> 
    6831     DNS is highly mission critical, it is therefore necessary to be able to study and compare DNS traffic. Since 2.9.18, PowerDNS comes 
    6832     with three tools to aid in analysis: 
    6833     <variablelist> 
    6834     <varlistentry> 
    6835     <term>dnsreplay pcapfile [ipaddress] [port number]</term> 
    6836     <listitem> 
    68376865    <para> 
    6838     This program takes recorded questions and answers and replays them to a specified nameserver and reporting afterwards 
    6839     which percentage of answers matched, were worse or better. 
    6840     </para> 
    6841     </listitem> 
    6842     </varlistentry> 
    6843     <varlistentry> 
    6844     <term>dnswasher pcapfile output</term> 
    6845     <listitem> 
    6846     <para> 
    6847     Anonymises recorded traffic, making sure it only contains DNS, and that the originating IP addresses of queries are stripped, which may 
    6848     allow you to send traces to our company or mailing list without violating obligations towards your customers or privacy laws. 
    6849     </para> 
    6850     </listitem> 
    6851     </varlistentry> 
    6852     <varlistentry> 
    6853     <term>dnsscope pcapfile</term> 
    6854     <listitem> 
    6855     <para> 
    6856     Calculates statistics without replaying traffic 
    6857     </para> 
    6858     </listitem> 
    6859     </varlistentry> 
    6860     </variablelist> 
     6866      DNS is highly mission critical, it is therefore necessary to be able to study and compare DNS traffic. Since 2.9.18, PowerDNS comes 
     6867      with three tools to aid in analysis: 
     6868      <warning> 
     6869        <para> 
     6870          As of 2.9.18 these tools are somewhat rough - they have no help messages for example. They do work though. 
     6871        </para> 
     6872      </warning> 
     6873      <variablelist> 
     6874        <varlistentry> 
     6875          <term>dnsreplay pcapfile [ipaddress] [port number]</term> 
     6876          <listitem> 
     6877            <para> 
     6878              This program takes recorded questions and answers and replays them to a specified nameserver and reporting afterwards 
     6879              which percentage of answers matched, were worse or better. 
     6880            </para> 
     6881          </listitem> 
     6882        </varlistentry> 
     6883        <varlistentry> 
     6884          <term>dnswasher pcapfile output</term> 
     6885          <listitem> 
     6886            <para> 
     6887              Anonymises recorded traffic, making sure it only contains DNS, and that the originating IP addresses of queries are stripped, which may 
     6888              allow you to send traces to our company or mailing list without violating obligations towards your customers or privacy laws. 
     6889            </para> 
     6890          </listitem> 
     6891        </varlistentry> 
     6892        <varlistentry> 
     6893          <term>dnsscope pcapfile</term> 
     6894          <listitem> 
     6895            <para> 
     6896              Calculates statistics without replaying traffic 
     6897            </para> 
     6898          </listitem> 
     6899        </varlistentry> 
     6900      </variablelist> 
    68616901    </para> 
    68626902  </chapter> 
    … …  
    88238863    <sect1 id="ldap"><Title>LDAP backend</title> 
    88248864      <para> 
     8865        <warning> 
     8866          <para> 
     8867            This documentation has moved to <ulink url="http://wiki.linuxnetworks.de/index.php/PowerDNS_ldapbackend">its own page</ulink>. The information in this chapter 
     8868            may be outdated! 
     8869          </para> 
     8870        </warning> 
     8871      <para> 
    88258872        The main author for this module is Norbert Sendetzky who also has his own <ulink url="http://www.linuxnetworks.de/pdnsldap/index.html">PowerDNS-LDAP page</ulink>. 
     8873      </para> 
     8874      <para> 
     8875        He also maintains the <ulink url="http://wiki.linuxnetworks.de/index.php/PowerDNS_ldapbackend">LDAP backends documentation</ulink> there. The information  
     8876        below may be outdated! 
    88268877      </para> 
    88278878      <para>